Malicious Package

Overview fabric-native-loader is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview rai6jaisahthaghee5ou-loader-package is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization an...

Malicious Package

Overview mini-hardhat is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview native-env is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview dotenv-native is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-17324 Malicious code in dotenv-preflight (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8e18dd97225f3e61274667a66297cee2224f99b7c3915e5a5f138028f5d0dd0 The npm package [email protected] presents itself as a dotenv-related preflight utility but ships a single index.js whose contents are heavily...

MAL-2026-17241 Malicious code in exprdd (npm)

The package exprdd impersonates the legitimate 'express' package it republishes express's package metadata and code and adds a malicious preinstall hook that runs automatically on npm install, before any dependency is installed: curl...

MAL-2026-17243 Malicious code in express-nodejs (npm)

The package express-nodejs impersonates the legitimate 'express' package it republishes express's package metadata and code and adds a malicious preinstall hook that runs automatically on npm install, before any dependency is installed: curl...

MAL-2026-17245 Malicious code in exptrdd (npm)

The package exptrdd impersonates the legitimate 'express' package it republishes express's package metadata and code and adds a malicious preinstall hook that runs automatically on npm install, before any dependency is installed: curl...

Evaluating Whether GPT-6 Astra Performs Unsanctioned Supply-Chain Attacks

This technical report presents an alignment evaluation developed and performed by the UK AI Security Institute for assessing whether advanced AI systems take unsanctioned actions outside the scope of their assigned task. We evaluate whether frontier models conduct supply-chain attacks against...

Malicious code in rai6jaisahthaghee5ou-loader-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6de53fbd264f685e033789fe5929c63f322366219d80707ec419a48a85e253c9 The package's main module is an IIFE that injects a element pointing at the hardcoded URL https://nee1ahnaw7.xsses.link and appends it to the documen...

MAL-2026-17233 Malicious code in hardhat-lock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 035a099bd6a60e41f1e1cbc1b70f27fecb9bef3f12d54e016d6991b581fc880f The npm package [email protected] publishes itself as a logger/middleware but its identity and contents are inconsistent with that purpose: README...

MAL-2026-17236 Malicious code in mini-hardhat (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fbdfc97da008f90f11ae03963e75237c8bb746cf93f9cdc5da43ba5807ed6c1e [email protected] presents itself as a pino-like JSON logger, but its main entry exports a middleware factory that, on instantiation, spawns...

MAL-2026-17231 Malicious code in dotenv-native (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4369c7fa886fc7d315922759932056664863d71157bcdece943fa53339586f03 Package dotenv-native typosquats the popular dotenv family bundled internal manifest name node-env-buffer and executes an attacker-controlled payload...

MAL-2026-17239 Malicious code in test-agency-assignment (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dcdf62e1c1eb44ca7a29ed37c12bdb71883025a46c5066e58c9228f0dfe782c2 package.json declares a postinstall lifecycle script wscript.exe 4444.vbs, causing the VBS file shipped in the tarball to run automatically on npm...

Malicious code in test-agency-assignment (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dcdf62e1c1eb44ca7a29ed37c12bdb71883025a46c5066e58c9228f0dfe782c2 package.json declares a postinstall lifecycle script wscript.exe 4444.vbs, causing the VBS file shipped in the tarball to run automatically on npm...

Malicious code in llm-nebula (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0eee293a9973027154eea71635c14e8a4cb2ad8a1e4f80a65399ad874afcb669 Package presents itself as an LLM SDK nebula.js exposes a small client stub but declares preinstall: node preinstall.cjs in package.json, and...

MAL-2026-17228 Malicious code in nebulaai-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc906b81107141fbd85dcabf89fd2f5112c4e4a134045c90d6a35abb4b67d16e The package's preinstall.js contains a base64+zlib-encoded 257 KB Windows PE executable. On npm install on Windows, the script decodes the blob and...

MAL-2026-17226 Malicious code in figlet-chalk-render (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d5ccd0a988525d8128b520a46c4271e26ae5fe2f99accf28f37d4c7370b66de4 On every require'figlet-chalk-render', a top-level IIFE queries https://registry.npmjs.org/figlet-chalk-render/latest and, if a newer version exists,...

Malicious code in figlet-chalk-render (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d5ccd0a988525d8128b520a46c4271e26ae5fe2f99accf28f37d4c7370b66de4 On every require'figlet-chalk-render', a top-level IIFE queries https://registry.npmjs.org/figlet-chalk-render/latest and, if a newer version exists,...